feat: Function triggers — schedule, inbound hook, domain events

Migration 00016: function_id on scheduled_jobs/inbound_hooks,
event_pattern on functions, 'event' in the run-trigger enum.

- Jobs deliver to a function instead of HTTP when function_id is set;
  the run's status_code mirrors the process exit code. Clearing the
  field returns the job to URL delivery.
- Inbound hooks gain mode "function" — received body becomes stdin
  payload, acked immediately, run recorded async.
- event_pattern (document.*, *, exact type) fires the function detached
  on matching publishEvent — never blocks realtime/webhook fan-out.
- One executeFunction path serves manual/schedule/hook/event; run rows
  record the trigger source.
- Backend image now ships bun 1.3.14 so Functions work under compose.

Dashboard: job target picker, hook function mode, event-pattern field.

Verified live: job run → success (status_code 0), hook POST → run,
document.created → event run with correct payload.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/services/functions_test.go

@@ -70,3 +70,17 @@ func TestLimitedWriterCaps(t *testing.T) {
 		t.Fatalf("got %q", buf.String())
 	}
 }
+
+func TestTriggerFromJobRun(t *testing.T) {
+	for in, want := range map[string]string{
+		"schedule": "schedule",
+		"hook":     "hook",
+		"manual":   "manual",
+		"cli":      "schedule",
+		"":         "schedule",
+	} {
+		if got := triggerFromJobRun(in); got != want {
+			t.Fatalf("triggerFromJobRun(%q) = %q, want %q", in, got, want)
+		}
+	}
+}